KR101812311B1 - User terminal and data sharing method of user terminal based on attributed re-encryption - Google Patents

User terminal and data sharing method of user terminal based on attributed re-encryption Download PDF

Info

Publication number
KR101812311B1
KR101812311B1 KR1020160031613A KR20160031613A KR101812311B1 KR 101812311 B1 KR101812311 B1 KR 101812311B1 KR 1020160031613 A KR1020160031613 A KR 1020160031613A KR 20160031613 A KR20160031613 A KR 20160031613A KR 101812311 B1 KR101812311 B1 KR 101812311B1
Authority
KR
South Korea
Prior art keywords
user terminal
data
cloud server
key
secret key
Prior art date
Application number
KR1020160031613A
Other languages
Korean (ko)
Other versions
KR20170107818A (en
Inventor
이임영
김수현
Original Assignee
순천향대학교 산학협력단
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 순천향대학교 산학협력단 filed Critical 순천향대학교 산학협력단
Priority to KR1020160031613A priority Critical patent/KR101812311B1/en
Publication of KR20170107818A publication Critical patent/KR20170107818A/en
Application granted granted Critical
Publication of KR101812311B1 publication Critical patent/KR101812311B1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F15/00—Digital computers in general; Data processing equipment in general
    • G06F15/16—Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2211/00—Indexing scheme relating to details of data-processing equipment not covered by groups G06F3/00 - G06F13/00
    • G06F2211/007—Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
    • G06F2211/008—Public Key, Asymmetric Key, Asymmetric Encryption

Abstract

The embodiment includes a communication module for performing data transmission / reception with a cloud server, a memory for storing a cloud service application, and a controller for encrypting and transmitting data to the cloud server by executing the application, The present invention provides an attribute re-encryption based data sharing system for generating a secret key, encrypting data using the secret key, and re-encrypting the secret key according to a data sharing request of another user. Accordingly, it is possible to provide the rights management of the user based on the attribute encryption technique, and receive the re-encryption key of only the trusted user and decrypt the data stored in the server.

Description

[0001] USER TERMINAL AND DATA SHARING METHOD OF USER TERMINAL BASED ON ATTRIBUTED RE-ENCRYPTION [0002]

The present invention relates to a data sharing system and a method thereof. More particularly, the present invention relates to a data sharing system based on attribute re-encryption that shares data and a method thereof.

Recently, interest in cloud computing has been growing at home and abroad. Many companies are interested in cloud computing, which is based on the growth of IT technology, is scalable to various fields, and enables efficient use of computing power. Global Internet service providers such as Google and Yahoo are aware of the importance of the Internet service platform and conduct research and development on their own, and develop a large-scale cluster-based distributed computing platform technology based on low-cost commercial nodes.

Representative applications that require large-scale data processing and storage management include a business model for expanding to other application areas such as business intelligence, for example, in addition to the Internet service field. As distributed data services become available in distributed computing environments, distributed management of large amounts of data becomes a major issue.

The storage of a large amount of user data in these cloud storage is causing problems in the reliability of cloud storage. Various cryptographic techniques for securely storing user data stored in a cloud server from untrusted administrators and attackers are being researched. However, existing data encryption technologies have a difficulty in applying data sharing services among a plurality of users on a cloud storage.

The present invention provides a data reuse-based data sharing method in which only a user having a data re-encryption key finally accesses data through classification according to access authority among users who want to share data through an attribute re-encryption technique.

The embodiment includes a communication module for performing data transmission / reception with a cloud server, a memory for storing a cloud service application, and a controller for encrypting and transmitting data to the cloud server by executing the application, The present invention provides an attribute re-encryption based data sharing system for generating a secret key, encrypting data using the secret key, and re-encrypting the secret key according to a data sharing request of another user.

The control unit generates a public key and a master key, and generates the secret key by inputting the master key and the attribute set.

The embodiment of the present invention includes the steps of generating a public key and a master key, generating a secret key by inputting the master key and an attribute set, encrypting data using the secret key, Receiving the request, and re-encrypting and transmitting the private key according to an attribute of the another user.

The encrypting step may divide the encrypted data and store the encrypted data in the cloud server.

The attribute-based data access method of the present invention can be used to provide the user's authority management based on the attribute encryption technique.

Also, the data stored in the server can be decrypted by receiving the re-encryption key of only the trusted user.

Also, compared with existing attribute-based data sharing schemes, the increased amount of computation in the data sharing process can be reduced by using re-encryption.

In the present invention, since the re-encryption key is generated as a key for providing one-time data sharing in the process of re-encrypting the encryption key of the user, the re-encryption key can provide backward security.

1 is a configuration diagram showing a network configuration of a data sharing system according to the present invention.
2 is a block diagram of an embodiment of the user terminal of FIG.
3 is a full flowchart showing the operation of the present invention.
4 is a flowchart illustrating the secret key generation step of FIG.
5 is a flowchart illustrating the encryption step of FIG.
FIG. 6 is a flowchart for explaining the decoding step of FIG. 3. FIG.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

The terms first, second, A, B, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

Referring to FIG. 1, a network configuration of a data sharing system according to the present invention includes a plurality of user terminals 100 connected to an administrator server 200 and a cloud server 300 via a wired / wireless communication network.

The user terminal 100 includes a smart phone for transmitting / receiving data to / from the manager server 200 and the cloud server 300 through a wireless communication network, and an application capable of executing a cloud service is mounted.

 The user terminal 100 on which the cloud application is installed can function as one data sharing system and when it is desired to share personal data stored in another user terminal 100 and the cloud server 300, It is possible to provide a shared system that can increase the reliability through the use of the system.

Meanwhile, the administrator server 200 may receive the encrypted secret key and the like from the user terminal 100 in cooperation with the plurality of user terminals 100, and may match the encrypted secret key with the data. The manager server 200 may control the cloud server 300 in conjunction with the cloud server 300 and store data in the cloud server 300. [

The cloud server 300 is a memory that receives data from the user terminal 100, receives data from the administrator server 200 and stores the data, and transmits the stored data again at the request of the user terminal 100. [ And provides a cloud service.

The data sharing system according to the present invention may refer to a user terminal 100 in which a cloud service application is installed.

The user terminal 100 may be implemented as shown in FIG.

2, the user terminal 100 includes a control unit 110, a communication module 120, a memory 140, and a display module 130. [

The communication module 120 includes a wired / wireless communication port and is capable of transmitting and receiving data to and from the cloud server 300 and the administrator server 200 via Wi-Fi / 3G.

The display module 130 includes a display module such as an LED and an LCD to display an application to be executed to a user, and provides text and images.

The memory 140 is a storage medium for storing an operating system and a plurality of programs. At this time, a cloud service application is installed in the memory 140 as one of the programs.

The control unit 110 controls each program to be executed using an operating system and a program stored in the memory 140. [

The controller 110 operates the cloud service application among the programs so that the user terminal 100 can access the cloud data based on the attribute.

The control unit 110 encrypts data to be stored by the user terminal 100 using an attribute-based cryptosystem, and then requests another user terminal 100 to share data with the user terminal 100 , It generates a re-encryption key capable of decrypting the encrypted data with its own attribute and transmits the re-encryption key to the other user terminal 100.

Hereinafter, the operation of the data sharing system of the present invention will be described with reference to FIG. 3 to FIG.

First, a method in which the user terminal 100 executes an application and stores data in the cloud server 300 will be described. In this case, the terminal 100 that encrypts data is referred to as a terminal A 101 and the terminal 100 that requests sharing is referred to as a terminal B in FIG. 3, and each terminal can function as a unique data sharing system.

The entire cloud computing environment can be designed with Apache's Hadoop Distrubute File System (HDFS). According to the present invention, a user satisfying a specific attribute in one group is authorized to obtain a decryption key based on the CP-ABE. At this time, You will ultimately get permission to do so. When the terminal A 101 wants to share data with the terminal B 102, the terminals A 101 and B have the same decoding right if they have the same attribute. However, if they have different attributes, it is necessary to discard the attributes of other terminals. The terminal A re-encrypts the cipher key for decrypting the data encrypted with the attribute of the terminal A based on the property public key of the terminal B 102 to be shared and transmits the cipher key to the terminal B 102.

Accordingly, the present invention reduces the unnecessary processes in the resistance and the sharing step, which is a problem occurring in the data sharing process of the conventional attribute-based cryptosystem, thereby providing efficiency and sharing data more securely.

Before describing the embodiments of the present invention, the symbols used in the following description are defined as follows.

·

Figure 112016025408213-pat00001
: Number of participants

·

Figure 112016025408213-pat00002
: Participants in Secret Dispatch
Figure 112016025408213-pat00003
Set of

·

Figure 112016025408213-pat00004
: Minority

·

Figure 112016025408213-pat00005
: Confidential Information
Figure 112016025408213-pat00006

·

Figure 112016025408213-pat00007
: Confidential Information
Figure 112016025408213-pat00008
Set of

·

Figure 112016025408213-pat00009
: Public key used for encryption

·

Figure 112016025408213-pat00010
: Master key used for secret key generation

·

Figure 112016025408213-pat00011
: Private key corresponding to attribute L

·

Figure 112016025408213-pat00012
: Finite cycling group

·

Figure 112016025408213-pat00013
: Subgroup

·

Figure 112016025408213-pat00014
: Constructor of finite recursive group G

·

Figure 112016025408213-pat00015
: g-based elliptic curve

·

Figure 112016025408213-pat00016
: public key component generated with g value and random value

·

Figure 112016025408213-pat00017
: Property Value

·

Figure 112016025408213-pat00018
: Property Set

·

Figure 112016025408213-pat00019
: property
Figure 112016025408213-pat00020
≪ / RTI >

·

Figure 112016025408213-pat00021
: Approach structure

·

Figure 112016025408213-pat00022
: Plain text

·

Figure 112016025408213-pat00023
: Random value

First, as shown in FIG. 3, the terminal A 101 performs secret key generation (S10).

Specifically, the terminal A 101 performs setup, inputs a security parameter k, and outputs a public key PK and a master key MK corresponding to the set value (S11).

That is, after generating the circulating group G as shown in Equation (1), the terminal A (101)

Figure 112016025408213-pat00024
.

[ Equation 1 ]

Figure 112016025408213-pat00025

At this time, the terminal A (101)

Figure 112016025408213-pat00026
≪ RTI ID = 0.0 >
Figure 112016025408213-pat00027
≪ / RTI >

Figure 112016025408213-pat00028
Wow
Figure 112016025408213-pat00029
.

The public key PK of the terminal A (101)

Figure 112016025408213-pat00030
, And the master key MK
Figure 112016025408213-pat00031
.

Next, the terminal A 101 performs secret key generation (KeyGen) (S12).

The terminal A 101 receives the master key MK and the attribute set L and outputs the secret key SKL corresponding to the access structure.

Specifically, the terminal A (101)

Figure 112016025408213-pat00032
To generate a secret key.

The terminal A (101)

Figure 112016025408213-pat00033
Randomly < / RTI >
Figure 112016025408213-pat00034
.

At this time,

Figure 112016025408213-pat00035
, The terminal
Figure 112016025408213-pat00036
Lt; / RTI >
Figure 112016025408213-pat00037
If so,
Figure 112016025408213-pat00038
.

The secret key is expressed by Equation (2).

& Quot; (2 ) & quot ;

Figure 112016025408213-pat00039

The terminal A 101 transmits the generated secret key to the manager server 200 (S13), and the manager server 200 stores the secret key.

Next, the terminal encrypts data to be stored in the cloud server 300 (S20).

Specifically, the terminal A (101)

Figure 112016025408213-pat00040
And plaintext M are encrypted.

First, the terminal A (101)

Figure 112016025408213-pat00041
and
Figure 112016025408213-pat00042
(S21).

Next, the terminal A (101) calculates Ci as in Equation (3) (S22).

& Quot; (3 ) & quot ;

Figure 112016025408213-pat00043

At this time,

Figure 112016025408213-pat00044
(S23).

On the other hand, the terminal A (101) does not store the ciphertext CT as it is, but generates the ciphertext Ea by re-encrypting the ciphertext Ea (S24).

& Quot; (4 ) & quot ;

Figure 112016025408213-pat00045

The terminal A 101 transmits the Ea to the cloud server 300 (S25), and the cloud server 300 stores it in the storage (S26).

On the other hand, when the terminal B 102 requests data sharing to the terminal A 101 having the data ownership right (S30), the terminal B 102 requests the data sharing private key.

The terminal A 101 re-encrypts the cipher key for decrypting the data using the property public key of the terminal B 102 to which the data is to be shared (S31), and transmits it to the cloud server 300 and the terminal B 102 (S32).

Figure 112016025408213-pat00046

Specifically, the cloud server 300 performs re-encryption with the re-encryption key input from the terminal A 101, the target cipher text to be re-encrypted, and the terminal public key as follows (S33).

& Quot; (5 ) & quot ;

Figure 112016025408213-pat00047

Next, when the terminal B (102) requests the re-encrypted cipher text to the cloud server (300), the cloud server (300) transmits the re-encrypted cipher text in which the target cipher text is re-encrypted to the terminal B (102) ), And stores it (S35).

Terminal B 102 receives the re-encrypted ciphertext Eb and decrypts it with the re-encryption key sent from terminal A 101 (S40). At this time, the decryption is an algorithm for outputting the plaintext corresponding to the ciphertext by inputting the recovered secret key SKL and the ciphertext CT,

Figure 112016025408213-pat00048
. That is, the terminal B (102)
Figure 112016025408213-pat00049
And secret key
Figure 112016025408213-pat00050
.

& Quot; (6 ) & quot ;

Figure 112016025408213-pat00051

In this manner, the terminal B (102) obtains the plaintext M, thereby reducing the unnecessary processes in the resistance and sharing step, which is a problem occurring in the data sharing process of the conventional attribute-based encryption, can do.

On the other hand, if the secret key stored in the user terminal 100 is lost, the terminal 100 executes the setup process again. The ciphertext generated by the secret key is discarded. The cloud server 300 executes data encryption with the newly generated secret key. The hash code is used to check whether the secret key stored in the user terminal 100 is damaged. If the secret key is compromised, the secret key of the administrator server 200 is discarded. The user terminal 100 of the administrator server 200 executes secret key generation.

The user terminal 100 checks whether a secret key is compromised when performing data encryption with a secret key or data decryption. The user terminal 100 can check whether the user terminal 100 belongs to the administrator group before checking whether the secret key is damaged or not. If the user terminal 100 belongs to the administrator group, the user terminal 100 checks whether or not the secret key is compromised. The user terminal 100 checks whether or not the secret key has been tampered and performs data encryption or data decryption if the secret key is normal. When the secret key is abnormal, the user terminal 100 stops the data encryption or data decryption and executes secret key generation.

The terminal generates a cipher text using the generated secret key, and the terminal decrypts the cipher text using the recovered secret key. The encryption operation is executed in the terminal, and the decryption operation is executed in the terminal. After completing the decryption, the terminal provides a plain text decrypted with a cipher text to the terminal.

Although the preferred embodiments of the present invention have been described in detail with reference to the accompanying drawings, the present invention is by way of example only.

It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined in the appended claims.

Claims (4)

A communication module for performing data transmission / reception with the cloud server,
Memory to store the cloud service application, and
A controller for executing the cloud service application and encrypting and transmitting data to the cloud server;
/ RTI >
Wherein,
Generates a public key and a master key corresponding to the input security parameter,
Generates a secret key based on the user attribute using the generated master key and attribute set,
Encrypting the data to be stored in the cloud server using the secret key, transmitting the encrypted ciphertext to the cloud server, and storing the encrypted data in the cloud server,
When a request for sharing the data is received from another user terminal and a request for a data sharing secret key is received from the another user terminal, a cipher key capable of decrypting the encrypted cipher text using the property public key of the other user terminal To the cloud server and the other user terminal, and causes the other user terminal to decrypt the cipher text re-encrypted by the cloud server using the re-encryption key by using the re-encryption key
User terminal. The method according to claim 1,
Wherein the control unit divides the cipher text and transmits the cipher text to the cloud server as re-encryptable ciphertext. The user terminal generates a public key and a master key corresponding to security parameters, and generates a secret key based on the user attribute using the master key and the attribute set,
The user terminal encrypting data to be stored in a cloud server using the secret key,
Wherein the user terminal transmits the encrypted ciphertext to the cloud server to be stored in the cloud server,
Wherein the user terminal receives a request for a data sharing secret key from another user terminal upon receiving a sharing request for the data from another user,
The user terminal transmits a re-encryption key to the cloud server and the other user terminal by re-encrypting the cipher key capable of decrypting the encrypted cipher text using the property public key of the other user terminal, And causing the other user terminal to decrypt the cipher text re-encrypted by the cloud server using the re-encryption key
The method comprising the steps of: The method of claim 3,
Wherein the encrypting step divides the cipher text and stores the cipher text as a re-encryptable cipher text in the cloud server.

KR1020160031613A 2016-03-16 2016-03-16 User terminal and data sharing method of user terminal based on attributed re-encryption KR101812311B1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
KR1020160031613A KR101812311B1 (en) 2016-03-16 2016-03-16 User terminal and data sharing method of user terminal based on attributed re-encryption

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
KR1020160031613A KR101812311B1 (en) 2016-03-16 2016-03-16 User terminal and data sharing method of user terminal based on attributed re-encryption

Publications (2)

Publication Number Publication Date
KR20170107818A KR20170107818A (en) 2017-09-26
KR101812311B1 true KR101812311B1 (en) 2017-12-26

Family

ID=60036750

Family Applications (1)

Application Number Title Priority Date Filing Date
KR1020160031613A KR101812311B1 (en) 2016-03-16 2016-03-16 User terminal and data sharing method of user terminal based on attributed re-encryption

Country Status (1)

Country Link
KR (1) KR101812311B1 (en)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102605087B1 (en) * 2021-03-05 2023-11-23 순천향대학교 산학협력단 System and method for sharing patient's medical data in medical cloud environment
CN114640676B (en) * 2022-03-25 2023-10-24 中科众云(山东)大数据科技集团有限公司 Multi-metadata sharing method and system

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101464727B1 (en) * 2013-10-15 2014-11-27 순천향대학교 산학협력단 Cloud Data Access Control System and Method using CP-ABE

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101464727B1 (en) * 2013-10-15 2014-11-27 순천향대학교 산학협력단 Cloud Data Access Control System and Method using CP-ABE

Also Published As

Publication number Publication date
KR20170107818A (en) 2017-09-26

Similar Documents

Publication Publication Date Title
Han et al. A data sharing protocol to minimize security and privacy risks of cloud storage in big data era
US20160127128A1 (en) Management of cryptographic keys
US20170310479A1 (en) Key Replacement Direction Control System and Key Replacement Direction Control Method
KR101615137B1 (en) Data access method based on attributed
Agrawal et al. A trustworthy agent-based encrypted access control method for mobile cloud computing environment
CN110688666B (en) Data encryption and preservation method in distributed storage
US11128452B2 (en) Encrypted data sharing with a hierarchical key structure
CN102571329A (en) Password key management
Bali et al. Lightweight authentication for MQTT to improve the security of IoT communication
Murugesan et al. Analysis on homomorphic technique for data security in fog computing
Surv et al. Framework for client side AES encryption technique in cloud computing
Zhu et al. Fuzzy authorization for cloud storage
Qinlong et al. Improving security and efciency for encrypted data sharing in online social networks
Castiglione et al. A secure file sharing service for distributed computing environments
KR101812311B1 (en) User terminal and data sharing method of user terminal based on attributed re-encryption
KR102025989B1 (en) DATA MANAGEMENT SCHEME BASED ON PROXY RE-ENCRYPTION IN IoT LIGHTWEIGHT DEVICES AND SYSTEM
CN107872312B (en) Method, device, equipment and system for dynamically generating symmetric key
WO2017009388A1 (en) Encryption scheme using multiple parties
Liu et al. A secure and efficient data sharing framework with delegated capabilities in hybrid cloud
Yu et al. Secure and differentiated fog-assisted data access for Internet of Things
US11888971B2 (en) Sharing access to data externally
Dabhade et al. Data security in cloud using aggregate key and Diffie-Hellman algorithm
Ghanbarafjeh et al. Developing a secure architecture for internet of medical things using attribute-based encryption
Basavarajegowda et al. Enhanced CP-ABE with RSA for Secure and Revocable Data Transmission of Big Data in Cloud.
Ansara et al. Security of Information in Cloud Computing: A Systematic Review

Legal Events

Date Code Title Description
A201 Request for examination
E902 Notification of reason for refusal
E701 Decision to grant or registration of patent right
GRNT Written decision to grant